In the Linux kernel Bluetooth MTK driver, the function btmtk_isopkt_pad() fails to release an allocated USB Request Block (URB), leading to a memory leak in the kernel. The unreleased URB gradually consumes kernel memory, and repeated failures can exhaust memory resources, potentially causing kernel instability or panics. This flaw is a classic resource exhaustion issue (CWE-400) and results in denial of service to legitimate users.

The vulnerability exists in any Linux kernel build that contains the Bluetooth MTK driver before the commit that adds usb_free_urb() on the error path. No specific version numbers are supplied, so any distribution running an unpatched kernel with that driver is susceptible.

The EPSS score of <1% indicates a very low but non-zero exploitation probability, and the flaw is not listed in the CISA KEV, suggesting limited known exploitation. The attack vector is inferred: an attacker could trigger the failure path by sending malformed HCI packets to a BT MTK device or by executing local code that invokes the driver. Each failure increases the memory leak, so repeated exploitation can lead to resource depletion. The overall risk is moderate to high in environments where MTK Bluetooth devices are active. The CVSS score of 5.5 reflects a medium severity level, reinforcing the need for a timely patch.